PlayStation v4.05 Kernel Exploit Released

GaryOPA · Dec 27, 2017

As promised for months @SpecterDev has finally done it, PS4 owners on v4.05 can now enjoy their console like v1.76

For those living in the scene land of PlayStation, it is still Christmas as yet another great gift has appeared on the scene landscape for all to enjoy that still have PlayStation 4 console running the v4.05 firmware, now all we need is to have the promised v4.55 from @flat_z.

SpecterDev said:

Hope everyone had a Merry Christmas! Here's the 4.05 kernel exploit, fully implemented. Enjoy! Write-up coming soon!

Summary
In this project you will find a full implementation of the "namedobj" kernel exploit for the PlayStation 4 on 4.05. It will allow you to run arbitrary code as kernel, to allow jailbreaking and kernel-level modifications to the system. This release however, does not contain any code related to defeating anti-piracy mechanisms or running homebrew. This exploit does include a loader that listens for payloads on port 9020 and will execute them upon receival.

You can find fail0verflow's original write-up on the bug here, you can find my technical write-up which dives more into implementation specifics here (this is still in progress and will be published within the next few days).

Patches Included
The following patches are made by default in the kernel ROP chain:

Disable kernel write protection

Allow RWX (read-write-execute) memory mapping

Dynamic Resolving (sys_dynlib_dlsym) allowed from any process

Custom system call #11 (kexec()) to execute arbitrary code in kernel mode

Allow unprivileged users to call setuid(0) successfully. Works as a status check, doubles as a privilege escalation.

Notes

This exploit is actually incredibly stable at around 95% in my tests. WebKit very rarely crashes and the same is true with kernel.

I've built in a patch so the kernel exploit will only run once on the system. You can still make additional patches via payloads.

A custom syscall is added (#11) to execute any RWX memory in kernel mode, this can be used to execute payloads that want to do fun things like jailbreaking and patching the kernel.

An SDK is not provided in this release, however a barebones one to get started with may be released at a later date.

I've released a sample payload here that will make the necessary patches to access the debug menu of the system via settings, jailbreaks, and escapes the sandbox.

Contributors
I was not alone in this exploit's development, and would like to thank those who helped me along the way below.

qwertyoruiopz

Flatz

CTurt

Anonymous

Click to expand...

So after @SpecterDev tweeted out the good news, @flat_z replied with a nice tweet also, so stay tuned for more PS4 scene action!

Flat_z said:

after @SpecterDev released his exploit, i'll prepare stuff within a couple of days, someone need to backport it from 4.55 to 4.05, not hard to do. not sure if it will be a write-up or just snippets of code, let's see!
Click to expand...

For more info, please visit the official GITHub link below, and check out both Twitters and here for updates in the coming days/weeks.

OFFICIAL SITE: --> https://github.com/Cryptogenic/PS4-4.05-Kernel-Exploit

NEWS SOURCE #1: @SpecterDev (via) Twitter
NEWS SOURCE #2: @Flat_z (via) Twitter

DSpider · Dec 27, 2017

... now all we need is to have the promised v4.55 from @flat_z.
Click to expand...

That's a bit misleading, since the exploit was patched in 4.06. The promised "stuff" isn't a 4.55 release of the exploit (and I wouldn't call it "promised" either). These guys are just amazing. Hats down to them.

GaryOPA · Dec 27, 2017

DSpider said: ↑

That's a bit misleading, since the exploit was patched in 4.06. The promised "stuff" isn't a 4.55 release of the exploit (and I wouldn't call it "promised" either). These guys are just amazing. Hats down to them.
Click to expand...

There is v4.55 exploit and v5.01 exploit but both are totally 100% PRIVATE and will NOT be shared publicly for long time, if ever!

What @flat_z will be doing is releasing some of 'cool' info on like how to get backups and other shit working that he has done privately for his own v4.55 system, but the info he will release will be write-up or bits of code, that will allow an developer like @SpecterDev to backport his work done to v4.05 to make it into a nice full jailbreak, similar to v1.76 where their is already a bunch of game dumps working.

happydance · Dec 28, 2017

Just wondering... are there still stock 4.05 units being sold?

GaryOPA · Dec 28, 2017

happydance said: ↑

Just wondering... are there still stock 4.05 units being sold?
Click to expand...

Not sure if this article on Wololo's Blog from Oct. is still valid, but check it out:

http://wololo.net/2017/10/23/ps4-get-hands-ps4-4-05-firmware-lower/

PlayStation v4.05 Kernel Exploit Released

GaryOPA Master Phoenix Admin Staff Member Top-Dog Brass

Comments

DSpider Loyal Member

GaryOPA Master Phoenix Admin Staff Member Top-Dog Brass

happydance Loyal Member

GaryOPA Master Phoenix Admin Staff Member Top-Dog Brass

Share This Page

PlayStation v4.05 Kernel Exploit Released

GaryOPA Master Phoenix Admin Staff Member Top-Dog Brass

Comments

DSpider Loyal Member

GaryOPA Master Phoenix Admin Staff Member Top-Dog Brass

happydance Loyal Member

GaryOPA Master Phoenix Admin Staff Member Top-Dog Brass

Share This Page

Useful Searches